CVE-2026-44217
sse-channel: SSE Injection via unsanitized event fields
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
sse-channel is an SSE-implementation which can be used to any node.js http request/response stream. Prior to 4.0.1, implementations that allow user-provided values to be passed to event, retry or id fields are susceptible to event spoofing, where an attacker could inject arbitrary messages into the stream. This vulnerability is fixed in 4.0.1.
| CWE | CWE-93 |
| Vendor | rexxars |
| Product | sse-channel |
| Published | May 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for rexxars sse-channel
Be the first to know when new unknown vulnerabilities affecting rexxars sse-channel are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
rexxars / sse-channel
< 4.0.1